one of my data sources has host field in the raw packet. However when we search the events the host field is the name of the forwarder. Where do I rename that? I do use a transform, so can it be done there on ingestion?
What would be the syntak? in the props.conf file?
↧